SQL Server Stored Procedures and Rails
DHH says "it's not the Rails way" but I needed to access our application's stored procedures, so I wrote a module to do it.
This code is Copyright 2006 Rahoul Baruah - and is made available under the terms of the GNU Lesser General Public Licence.
Copy this code into a file named "sql_server.rb" and drop it into your models folder. Then, take one of your actual models, "include SQLServer" - and you have access to these functions that allow you to call SQL Server stored procedures.
6 comments:
unless you do lots of validation on the paramaters, this method could be used to launch an injection attack against the database.
eg
set one of the paramaters to be ';drop table ImportantTable'
the sql then executed is
exec @return_value = exec Myproc ; drop table ImportantTable
and the table ImportantTable is dropped
I've changed it to quote all parameter values - so now it relies on SQL Server to do the right thing (which is pretty doubtful).
Hahahahahahahaha stupid priests
if youre doing dynamic sql by parameters you deserve any stupid njections you get
yes, there's an M in MVC you know
Thanks alot. Great help
Post a Comment